What does 429 Too Many Requests mean, and how do you fix it?

What 429 Too Many Requests means

429 is the rate-limit status, defined in RFC 6585. It tells a specific client to slow down. The server may include a Retry-After header saying how many seconds to wait. Unlike 503, which says the whole service is unavailable, 429 is about one client's request volume.

Where you will meet it

• AI APIs. OpenAI, Anthropic, Google and others return 429 when you exceed requests or tokens per minute for your account tier, and some also use it when you run out of credit.
• Third-party APIs inside your app, such as payment, email or maps, each with their own limits.
• Your own backend, if you added rate limiting to login, signup or expensive endpoints.
• As a visitor, after refreshing a page many times or when a shared network looks like one busy client.

How to handle a 429 from an API

Do not retry immediately in a tight loop. That turns a short limit into a longer one and can get a key flagged.

• Read the Retry-After header if it is present and wait at least that long.
• Otherwise retry with exponential backoff and jitter: wait one second, then two, then four, with a little randomness so parallel workers do not retry in lockstep.
• Cap retries and surface a clear error to the user when the limit persists.
• Reduce request volume: batch work, cache responses that do not change, and stream instead of polling.
• Check your account tier and usage dashboard. Many limits rise with spend or a plan change.

for (let attempt = 0; attempt < 5; attempt++) {
  const res = await fetch(url, options);
  if (res.status !== 429) return res;
  const wait = Number(res.headers.get("retry-after")) || 2 ** attempt;
  await new Promise((r) => setTimeout(r, (wait + Math.random()) * 1000));
}

If a 429 says your quota or credit is exhausted, backoff will not help. Check the response body: providers distinguish rate limits from billing limits there.

Using 429 on your own site

Rate limiting with 429 protects login forms from password guessing, signup forms from spam and expensive endpoints from abuse. Limit per IP address and per account, return a short message, and include Retry-After so well-behaved clients know when to come back.

Be careful with limits that apply to all traffic from one IP address. Offices, universities and mobile carriers put many people behind one address.

What a 429 does to Google and AI crawlers

429 is the one 4xx status Google treats like a server error rather than a missing page. Googlebot slows down when it sees 429, and pages are not removed for it in the short term. That makes 429 or 503 the correct way to ask a crawler to back off. A 403 or 404 used for the same purpose removes pages from the index instead.

If 429s continue for a long time, Google eventually treats affected URLs as unavailable, so rate rules should target abuse, not ordinary crawling.

What a scan can and cannot tell you

WebAuditOS does not grade 429 as a page error, because a rate limit answering the scanner is protection working, not a broken page. It does check whether admin interfaces are linked from public pages, which is where rate limiting matters most.

A public scan cannot tell whether your login, signup or API endpoints are rate limited. That has to be tested directly, with care, against your own systems.

If your site rate limits aggressively, a scan may see fewer pages than exist. That limits the scan's coverage, not your site's quality.

Short answers

How long should I wait after a 429? As long as Retry-After says, or start at one second and double each time.

Why do I get 429 from the OpenAI or Claude API with low usage? Your tier's per-minute limit may be lower than you think, or parallel requests are bursting. Check the limits page for your account.

429 or 503 for my own rate limiting? 429 when one client is the problem, 503 when the whole service is overloaded.

Does 429 hurt SEO? Not when used briefly. Constant 429s to Googlebot will.